nx 23.2.0-beta.4 → 23.2.0-beta.6

package/dist/src/tasks-runner/life-cycles/performance-report.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MEANINGFUL_OVERHEAD = exports.MIN_RECOMMENDATION_RUN_DURATION = void 0;
+exports.prefetchRemoteCacheOnboardingUrl = prefetchRemoteCacheOnboardingUrl;
 exports.recommendationToPayloadString = recommendationToPayloadString;
 exports.buildRecommendations = buildRecommendations;
 exports.formatReport = formatReport;
@@ -8,14 +9,72 @@ exports.formatReportMarkdown = formatReportMarkdown;
 exports.buildExitSummaryPayload = buildExitSummaryPayload;
 const native_1 = require("../../native");
 const terminal_link_1 = require("../../utils/terminal-link");
+const nx_cloud_utils_1 = require("../../utils/nx-cloud-utils");
+const url_shorten_1 = require("../../nx-cloud/utilities/url-shorten");
+const get_cloud_options_1 = require("../../nx-cloud/utilities/get-cloud-options");
+const git_utils_1 = require("../../utils/git-utils");
+const logger_1 = require("../../utils/logger");
 const NX_AGENTS_URL = 'https://nx.dev/ci/features/distribute-task-execution';
-const NX_REMOTE_CACHE_URL = 'https://nx.dev/ci/features/remote-cache';
+// Fallback for the remote-cache CTA when the short onboarding URL can't be
+// fetched: the generic Cloud get-started page (still drives to onboarding).
+const NX_CLOUD_GET_STARTED_URL = 'https://cloud.nx.app/get-started';
 const NX_PERFORMANCE_URL = 'https://nx.dev/docs/concepts/ci-concepts/parallelization-distribution';
 /** utm tag attributing report clicks back to it; the content names the CTA clicked. */
 const utm = (content) => `?utm_source=nx-cli&utm_medium=cli&utm_campaign=performance-report&utm_content=${content}`;
 const NX_PERFORMANCE_LINK = `${NX_PERFORMANCE_URL}${utm('parallelization')}`;
 const NX_AGENTS_LINK = `${NX_AGENTS_URL}${utm('nx-agents')}`;
-const NX_REMOTE_CACHE_LINK = `${NX_REMOTE_CACHE_URL}${utm('remote-cache')}`;
+const NX_REMOTE_CACHE_LINK = `${NX_CLOUD_GET_STARTED_URL}${utm('remote-cache')}`;
+// Defaults to the get-started link; a disconnected workspace gets a short Nx
+// Cloud onboarding URL instead (see prefetchRemoteCacheOnboardingUrl).
+let remoteCacheLink = NX_REMOTE_CACHE_LINK;
+// Give up on the short URL after this long so a slow/hung Cloud API never
+// lingers past the exit report. Covers two sequential round trips (features
+// GET, onboarding POST); the 30s CTA floor leaves room. Timing out also aborts
+// the request - Promise.race alone would leave the socket holding the event
+// loop open, which strands programmatic callers that never process.exit.
+const ONBOARDING_URL_TIMEOUT = 5000;
+/**
+ * Point the remote-cache CTA at a short Nx Cloud onboarding URL for a
+ * disconnected GitHub workspace - the VCS flow where Cloud opens the nx.json PR.
+ * Non-GitHub remotes keep the get-started link (handles every provider) and skip
+ * the network entirely. Runs in CI too - terminal + job summary.
+ *
+ * Best-effort: the get-started link stays on failure/timeout. Fired at run start;
+ * the CTA needs a >30s run (MIN_RECOMMENDATION_RUN_DURATION), so the fetch
+ * always resolves first.
+ */
+async function prefetchRemoteCacheOnboardingUrl(nxJson) {
+    if ((0, nx_cloud_utils_1.isNxCloudDisabled)(nxJson) || (0, nx_cloud_utils_1.isNxCloudUsed)(nxJson)) {
+        return;
+    }
+    if ((0, git_utils_1.getVcsRemoteInfo)()?.domain !== 'github.com') {
+        return;
+    }
+    const abortController = new AbortController();
+    try {
+        const url = await Promise.race([
+            (0, url_shorten_1.createNxCloudOnboardingURL)('nx-cli-perf-report', undefined, undefined, false, false, undefined, abortController.signal),
+            new Promise((resolve) => {
+                // unref so the pending timer never keeps the CLI alive on its own.
+                setTimeout(() => {
+                    abortController.abort();
+                    resolve(null);
+                }, ONBOARDING_URL_TIMEOUT).unref();
+            }),
+        ]);
+        // createNxCloudOnboardingURL never throws - on an unreachable API it returns a
+        // paste-a-token URL (accessToken=undefined). Only accept a real short link.
+        if (url?.startsWith(`${(0, get_cloud_options_1.getCloudUrl)()}/connect/`)) {
+            remoteCacheLink = url;
+        }
+        else {
+            logger_1.logger.verbose(`Keeping the get-started remote-cache link (${url === null ? 'onboarding URL timed out' : `got: ${url}`})`);
+        }
+    }
+    catch (e) {
+        logger_1.logger.verbose(`Keeping the get-started remote-cache link: ${e}`);
+    }
+}
 /**
  * Whole-phrase CTA: the whole sentence is the link. The Rust TUI popup keeps no
  * copy of this string; it gets the phrase + href from the exit payload's `links`.
@@ -176,7 +235,7 @@ const RECOMMENDATIONS = [
             c.cacheableCount > 0 &&
             !c.remoteCacheEnabled &&
             c.cacheHits / c.cacheableCount <= LOW_CACHE_HIT_RATE,
-        build: () => [phraseLink(NX_REMOTE_CACHE_CTA, NX_REMOTE_CACHE_LINK), `.`],
+        build: () => [phraseLink(NX_REMOTE_CACHE_CTA, remoteCacheLink), `.`],
     },
     {
         // Cache skipped: drop the flag to restore unchanged tasks instantly.

package/dist/src/tasks-runner/run-command.js

@@ -39,6 +39,7 @@ const store_run_information_life_cycle_1 = require("./life-cycles/store-run-info
 const task_history_life_cycle_1 = require("./life-cycles/task-history-life-cycle");
 const task_profiling_life_cycle_1 = require("./life-cycles/task-profiling-life-cycle");
 const performance_life_cycle_1 = require("./life-cycles/performance-life-cycle");
+const performance_report_1 = require("./life-cycles/performance-report");
 const task_results_life_cycle_1 = require("./life-cycles/task-results-life-cycle");
 const task_telemetry_life_cycle_1 = require("./life-cycles/task-telemetry-life-cycle");
 const task_timings_life_cycle_1 = require("./life-cycles/task-timings-life-cycle");
@@ -80,6 +81,9 @@ async function getTerminalOutputLifeCycle(initiatingProject, initiatingTasks, pr
     if (tasks.length === 1 && !is_tui_enabled_1.ORIGINAL_TUI_ENV_VALUE) {
         process.env.NX_TUI = 'false';
     }
+    // Kick off in the background so the URL is ready by the exit report. A brief
+    // sync preamble (git remote + axios load) runs here; the network call does not.
+    (0, performance_report_1.prefetchRemoteCacheOnboardingUrl)(nxJson);
     if ((0, is_tui_enabled_1.isTuiEnabled)()) {
         const interceptedNxCloudLogs = [];
         // Resolve where the Nx Cloud client bundle actually loads from so the

package/dist/src/utils/assert-workspace-validity.js

@@ -3,7 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.assertWorkspaceValidity = assertWorkspaceValidity;
 const find_matching_projects_1 = require("./find-matching-projects");
 const output_1 = require("./output");
-const devkit_internals_1 = require("../devkit-internals");
+// Import from the defining module, not the devkit-internals barrel: this file
+// is on the project-graph construction path, and the barrel now eagerly
+// re-exports the project-graph modules, which would create a require cycle back
+// through build-project-graph. (Release modules cross the barrel as erased
+// types only — see the note in packages/devkit/internal.ts.)
+const error_types_1 = require("../project-graph/error-types");
 function assertWorkspaceValidity(projects, nxJson) {
     const projectNames = Object.keys(projects);
     const projectGraphNodes = projectNames.reduce((graph, project) => {
@@ -65,7 +70,7 @@ function assertWorkspaceValidity(projects, nxJson) {
         })
             .join('\n\n');
     }
-    throw new devkit_internals_1.WorkspaceValidityError(message);
+    throw new error_types_1.WorkspaceValidityError(message);
 }
 function detectAndSetInvalidProjectGlobValues(map, sourceName, desiredImplicitDeps, projectConfigurations, projects) {
     const invalidProjectsOrGlobs = desiredImplicitDeps.filter((implicit) => {

package/dist/src/utils/child-process.d.ts

@@ -1,7 +1,37 @@
-import { type ExecOptions, type ExecSyncOptions } from 'child_process';
+import { type ExecOptions, type ExecSyncOptions, type SpawnSyncOptions } from 'child_process';
 import { PackageManagerCommands } from './package-manager';
 import { ChildProcess } from '../native';
 export declare function getRunNxBaseCommand(packageManagerCommand?: PackageManagerCommands, cwd?: string): string;
+/**
+ * Locate an nx entry point to spawn for the workspace at `root`, so a caller
+ * can run it directly instead of going through a shell. `findInstalledNxBin`
+ * decides which one.
+ *
+ * Null means nothing may be spawned directly, leaving the caller to fall back
+ * to `getRunNxBaseCommand`. Null is therefore always safe: it costs the
+ * argument fidelity a direct spawn buys, never the ability to run.
+ */
+export declare function getNxBin(root?: string): string | null;
+/**
+ * The entry point the nx installed directly under `dir` names, with no ascent
+ * to `dir`'s ancestors. For an installation that declares nx itself, such as
+ * the temp CLI `nx migrate` builds, an ancestor's nx is never the right answer.
+ */
+export declare function readInstalledNxBin(dir: string): string | null;
+/**
+ * Run a nx command, passing the arguments through as an argv array.
+ *
+ * When `getNxBin` names an entry point, the child is spawned directly with no
+ * shell in between, so every argument reaches the child exactly as provided:
+ * shell metacharacters (`(`, `%`, `^`, spaces, quotes) are data, not syntax.
+ * Otherwise falls back to the package-manager + shell path, where every
+ * argument goes through `quoteShellArg` and the Windows limits it documents
+ * apply.
+ */
+export declare function runNxArgvSync(argv: string[], options?: SpawnSyncOptions & {
+    cwd?: string;
+    nxBin?: string;
+}): void;
 export declare function runNxSync(cmd: string, options?: ExecSyncOptions & {
     cwd?: string;
     packageManagerCommand?: PackageManagerCommands;

package/dist/src/utils/child-process.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PseudoTtyProcess = void 0;
 exports.getRunNxBaseCommand = getRunNxBaseCommand;
+exports.getNxBin = getNxBin;
+exports.readInstalledNxBin = readInstalledNxBin;
+exports.runNxArgvSync = runNxArgvSync;
 exports.runNxSync = runNxSync;
 exports.runNxAsync = runNxAsync;
 const child_process_1 = require("child_process");
@@ -10,9 +13,14 @@ const path_1 = require("path");
 const package_manager_1 = require("./package-manager");
 const workspace_root_1 = require("./workspace-root");
 const exit_codes_1 = require("./exit-codes");
+const fileutils_1 = require("./fileutils");
+const shell_quoting_1 = require("./shell-quoting");
 function getRunNxBaseCommand(packageManagerCommand, cwd = process.cwd()) {
     if ((0, fs_1.existsSync)((0, path_1.join)(workspace_root_1.workspaceRoot, 'package.json'))) {
         if (!packageManagerCommand) {
+            // `readLocalNxVersion` (command-line/migrate/migrate.ts) mirrors this
+            // selector to predict which nx a spawn will run, for the workspaces
+            // `getNxBin` declines to resolve; keep the two in sync.
             const pm = (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot);
             packageManagerCommand = (0, package_manager_1.getPackageManagerCommand)(pm, workspace_root_1.workspaceRoot);
         }
@@ -28,6 +36,101 @@ function getRunNxBaseCommand(packageManagerCommand, cwd = process.cwd()) {
         }
     }
 }
+/**
+ * Locate an nx entry point to spawn for the workspace at `root`, so a caller
+ * can run it directly instead of going through a shell. `findInstalledNxBin`
+ * decides which one.
+ *
+ * Null means nothing may be spawned directly, leaving the caller to fall back
+ * to `getRunNxBaseCommand`. Null is therefore always safe: it costs the
+ * argument fidelity a direct spawn buys, never the ability to run.
+ */
+function getNxBin(root = workspace_root_1.workspaceRoot) {
+    // A workspace with no root package.json runs nx through the `./nx` wrapper,
+    // which reinstalls `.nx/installation` whenever it drifts from nx.json's
+    // `installation.version`. Spawning the resolved entry point would skip that
+    // sync, and a migration is precisely when the version changes.
+    if (!(0, fs_1.existsSync)((0, path_1.join)(root, 'package.json'))) {
+        return null;
+    }
+    return findInstalledNxBin(root);
+}
+/**
+ * The entry point the nx installed directly under `dir` names, with no ascent
+ * to `dir`'s ancestors. For an installation that declares nx itself, such as
+ * the temp CLI `nx migrate` builds, an ancestor's nx is never the right answer.
+ */
+function readInstalledNxBin(dir) {
+    const packageDir = (0, path_1.join)(dir, 'node_modules', 'nx');
+    const manifest = (0, path_1.join)(packageDir, 'package.json');
+    if (!(0, fs_1.existsSync)(manifest)) {
+        return null;
+    }
+    let bin;
+    try {
+        ({ bin } = (0, fileutils_1.readJsonFile)(manifest));
+    }
+    catch {
+        return null;
+    }
+    // npm accepts both the single-entry shorthand and the map form.
+    const entry = typeof bin === 'string' ? bin : bin?.nx;
+    return typeof entry === 'string' ? (0, path_1.join)(packageDir, entry) : null;
+}
+// Ascend to the nearest installed nx and take the entry point its `bin` field
+// names, which is the file a package manager links into `node_modules/.bin`.
+// Deliberately npx-shaped: npx and bun ascend unconditionally while pnpm and
+// yarn stop at an outer workspace, so this can name an nx those two would
+// decline to run.
+//
+// Deliberately not a resolver. Resolvers answer from NODE_PATH once their
+// explicit paths miss, and `nxCliPath` (command-line/migrate/migrate.ts) points
+// NODE_PATH at the temp installation before spawning it; they also answer
+// through package self-reference, which hands back the running nx whatever
+// `paths` they are given. Either one lets the temp installation hand off to
+// itself, which for `--run-migrations` re-enters the same hand-off and respawns
+// without end.
+function findInstalledNxBin(root) {
+    for (let dir = root;; dir = (0, path_1.dirname)(dir)) {
+        // The nearest install wins, so an unusable manifest there ends the search
+        // rather than deferring to an ancestor.
+        if ((0, fs_1.existsSync)((0, path_1.join)(dir, 'node_modules', 'nx', 'package.json'))) {
+            return readInstalledNxBin(dir);
+        }
+        if (dir === (0, path_1.dirname)(dir)) {
+            return null;
+        }
+    }
+}
+/**
+ * Run a nx command, passing the arguments through as an argv array.
+ *
+ * When `getNxBin` names an entry point, the child is spawned directly with no
+ * shell in between, so every argument reaches the child exactly as provided:
+ * shell metacharacters (`(`, `%`, `^`, spaces, quotes) are data, not syntax.
+ * Otherwise falls back to the package-manager + shell path, where every
+ * argument goes through `quoteShellArg` and the Windows limits it documents
+ * apply.
+ */
+function runNxArgvSync(argv, options) {
+    let { nxBin, ...spawnOptions } = options ?? {};
+    spawnOptions.cwd ??= process.cwd();
+    spawnOptions.windowsHide ??= true;
+    nxBin ??= getNxBin((0, workspace_root_1.workspaceRootInner)(spawnOptions.cwd, null) ?? workspace_root_1.workspaceRoot);
+    if (!nxBin) {
+        runNxSync(argv.map(shell_quoting_1.quoteShellArg).join(' '), spawnOptions);
+        return;
+    }
+    const result = (0, child_process_1.spawnSync)(process.execPath, [nxBin, ...argv], spawnOptions);
+    if (result.error) {
+        throw result.error;
+    }
+    if (result.status !== 0) {
+        const error = new Error(`Command failed: nx ${argv.join(' ')} (exit code ${result.status})`);
+        error.status = result.status ?? 1;
+        throw error;
+    }
+}
 function runNxSync(cmd, options) {
     let { packageManagerCommand, ...execSyncOptions } = options ?? {};
     execSyncOptions.cwd ??= process.cwd();

package/dist/src/utils/ignore.d.ts

@@ -1,7 +1,134 @@
 import ignore = require('ignore');
 import { Tree } from '../generators/tree';
 export declare function getIgnoreObject(root?: string): ReturnType<typeof ignore>;
-export declare function getIgnoreObjectForTree(tree: Tree): ignore.Ignore;
+/** One directory's ignore files, and the directory its patterns are rooted at. */
+export type ScopedIgnoreMatcher = {
+    /** Workspace-relative POSIX directory, `''` for the workspace root. */
+    dir: string;
+    /** How they relate is decided at build time - see `merge`. */
+    matchers: ReturnType<typeof ignore>[];
+};
+/**
+ * Resolves the ignore files that apply to a directory: its own and every one
+ * above it, up to the workspace root.
+ *
+ * Ignore files cascade - a `.gitignore` covers its own directory and below, and
+ * its patterns are relative to *itself*, not to the workspace root. Reading only
+ * the root file, which is what `getIgnoreObject` does, silently misses every
+ * nested one.
+ *
+ * A directory's answer is its own files plus its parent's, so every directory on
+ * the way up is memoized rather than only the one asked for: sibling leaves
+ * share the whole trunk, and a later walk stops at the first directory already
+ * known.
+ *
+ * `read` decides where the files come from - `tree.read` for a generator, disk
+ * for a caller with no tree - and returns an empty string or null when there is
+ * no such file. Paths handed to it are workspace-relative POSIX.
+ *
+ * `merge` decides how the files *within one directory* relate, and the two
+ * consumers genuinely need different rules:
+ *
+ * - `false` is prettier's: one matcher per file, any of them excluding wins, and
+ *   a negation counts only if none excluded. `createIsIgnoredFunction` builds an
+ *   ignorer per `--ignore-path` and ORs them, so a `!x` in `.prettierignore`
+ *   cannot re-include an `x` that `.gitignore` excluded.
+ * - `true` is git's and the native walker's: all files in one matcher, so
+ *   `.nxignore`'s `!x` removes `.gitignore`'s exclusion of `x` outright. It has
+ *   to be a merge rather than a precedence check between separate matchers,
+ *   because a lone `!x` in its own matcher reports an opinion on `x/` but *none*
+ *   on `x/a.ts` (measured), so the exclusion would still reach the children.
+ *   The merge only removes the exclusion within that one directory - a negation
+ *   in a nested file still loses to an ancestor's exclusion.
+ *
+ * When `merge` is true, `filenames` order matters: they go into one matcher in
+ * order and the last matching pattern decides, so list them lowest-authority
+ * first.
+ */
+export declare function createIgnoreChainResolver(read: (path: string) => string | null | undefined, filenames: string[], merge: boolean): (dir: string) => ScopedIgnoreMatcher[];
+/**
+ * True when the file is ignored, resolving the chain nearest file first.
+ *
+ * Each matcher is tested against the path relative to its own directory, which
+ * is what makes a nested pattern like `/build` mean that directory's `build`
+ * rather than the workspace's.
+ *
+ * Nearest directory with an *opinion* wins, not the first match: a nested
+ * `!keep.log` must override the root's `*.log`, which is git's rule for files.
+ * A nested negation of a *directory* does not reach its children - see the
+ * `merge` note on `createIgnoreChainResolver`.
+ *
+ * How the files of one directory relate is decided when the chain is built - see
+ * that same note. Here they are simply the entry's matchers: any one excluding
+ * wins, and a negation counts only if none excluded.
+ *
+ * Two preconditions, both satisfied by a pruning walk and neither enforced:
+ *
+ * - `filePath` is workspace-relative POSIX and must sit under every `dir` in the
+ *   chain, which holds when the chain came from that file's own directory.
+ * - No ancestor directory of `filePath` may itself be ignored. git refuses to
+ *   re-include a file inside an excluded directory, and this does not implement
+ *   that rule: asked directly about `dist/keep.ts` with a root `dist/` and a
+ *   nested `dist/.gitignore` holding `!keep.ts`, it answers "not ignored" where
+ *   git says ignored (measured). `visitNotIgnoredFiles` never asks, because it
+ *   prunes `dist/` before descending - which is what makes its answers match
+ *   git, and why that pruning is load-bearing for correctness rather than speed.
+ */
+export declare function isIgnoredByChain(chain: ScopedIgnoreMatcher[], filePath: string): boolean;
+/**
+ * Directories that should never be walked, whatever the workspace's own ignore
+ * files say - `node_modules`, `.git`, the nx caches.
+ *
+ * The list comes from the native walker rather than a second copy here, so a
+ * filesystem walk and a tree walk cannot drift apart.
+ *
+ * Checked ahead of the cascading chain rather than folded into it: these are not
+ * re-includable, and as ordinary patterns a nested negation could resurrect
+ * `node_modules`.
+ */
+export declare function isAlwaysIgnored(path: string): boolean;
+/**
+ * The chain bound to a tree, as predicates over workspace-relative POSIX paths.
+ *
+ * Files and directories are asked separately because the answers differ: a
+ * pattern is only directory-only if it ends in a slash, and `ignore` will not
+ * match `dist/` against the path `dist`. Callers must not have to know that, so
+ * the slash is appended inside and never leaves this module.
+ */
+export type TreeIgnoreChecker = {
+    isIgnoredFile: (path: string) => boolean;
+    isIgnoredDirectory: (path: string) => boolean;
+};
+/**
+ * What git ignores, which is also what the native walker ignores.
+ *
+ * `.nxignore` outranks `.gitignore` - `walker.rs` registers it with
+ * `add_custom_ignore_filename` - which a merge with `.nxignore` last reproduces.
+ * git itself does not read it.
+ *
+ * Reads from the tree rather than disk because a generator can create or amend
+ * an ignore file in the same run, which would leave the on-disk copy stale.
+ */
+export declare function createGitIgnoreChecker(tree: Tree): TreeIgnoreChecker;
+/**
+ * What prettier ignores: the workspace root only, and one ignorer per
+ * `--ignore-path` ORed rather than merged (both measured), so a `!` in
+ * `.prettierignore` cannot re-include what `.gitignore` excluded. That is the
+ * CLI `nx format:check` shells out to.
+ *
+ * Not an exact match for that command: `isAlwaysIgnored` is wider than
+ * prettier's built-ins, and `format.ts` filters its own patterns through
+ * `.nxignore`, which this does not read.
+ *
+ * Reads from the tree rather than disk, as above.
+ */
+export declare function createPrettierIgnoreChecker(tree: Tree): TreeIgnoreChecker;
+/**
+ * `path.dirname` for the workspace-relative POSIX paths the chain is keyed by,
+ * except that the workspace root is `''` rather than `.` - that is the key
+ * `createIgnoreChainResolver` terminates on.
+ */
+export declare function posixDirname(relativePath: string): string;
 /**
  * Adds an entry to a .gitignore file if it's not already covered by existing patterns.
  * Creates the file if it doesn't exist.

package/dist/src/utils/ignore.js

@@ -1,9 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getIgnoreObject = getIgnoreObject;
-exports.getIgnoreObjectForTree = getIgnoreObjectForTree;
+exports.createIgnoreChainResolver = createIgnoreChainResolver;
+exports.isIgnoredByChain = isIgnoredByChain;
+exports.isAlwaysIgnored = isAlwaysIgnored;
+exports.createGitIgnoreChecker = createGitIgnoreChecker;
+exports.createPrettierIgnoreChecker = createPrettierIgnoreChecker;
+exports.posixDirname = posixDirname;
 exports.addEntryToGitIgnore = addEntryToGitIgnore;
 const ignore = require("ignore");
+const index_1 = require("../native/index");
 const fileutils_1 = require("./fileutils");
 const workspace_root_1 = require("./workspace-root");
 function getIgnoreObject(root = workspace_root_1.workspaceRoot) {
@@ -12,18 +18,182 @@ function getIgnoreObject(root = workspace_root_1.workspaceRoot) {
     ig.add((0, fileutils_1.readFileIfExisting)(`${root}/.nxignore`));
     return ig;
 }
-function getIgnoreObjectForTree(tree) {
-    let ig;
-    if (tree.exists('.gitignore')) {
-        ig = ignore();
-        ig.add('.git');
-        ig.add(tree.read('.gitignore', 'utf-8'));
-    }
-    if (tree.exists('.nxignore')) {
-        ig ??= ignore();
-        ig.add(tree.read('.nxignore', 'utf-8'));
+/**
+ * Resolves the ignore files that apply to a directory: its own and every one
+ * above it, up to the workspace root.
+ *
+ * Ignore files cascade - a `.gitignore` covers its own directory and below, and
+ * its patterns are relative to *itself*, not to the workspace root. Reading only
+ * the root file, which is what `getIgnoreObject` does, silently misses every
+ * nested one.
+ *
+ * A directory's answer is its own files plus its parent's, so every directory on
+ * the way up is memoized rather than only the one asked for: sibling leaves
+ * share the whole trunk, and a later walk stops at the first directory already
+ * known.
+ *
+ * `read` decides where the files come from - `tree.read` for a generator, disk
+ * for a caller with no tree - and returns an empty string or null when there is
+ * no such file. Paths handed to it are workspace-relative POSIX.
+ *
+ * `merge` decides how the files *within one directory* relate, and the two
+ * consumers genuinely need different rules:
+ *
+ * - `false` is prettier's: one matcher per file, any of them excluding wins, and
+ *   a negation counts only if none excluded. `createIsIgnoredFunction` builds an
+ *   ignorer per `--ignore-path` and ORs them, so a `!x` in `.prettierignore`
+ *   cannot re-include an `x` that `.gitignore` excluded.
+ * - `true` is git's and the native walker's: all files in one matcher, so
+ *   `.nxignore`'s `!x` removes `.gitignore`'s exclusion of `x` outright. It has
+ *   to be a merge rather than a precedence check between separate matchers,
+ *   because a lone `!x` in its own matcher reports an opinion on `x/` but *none*
+ *   on `x/a.ts` (measured), so the exclusion would still reach the children.
+ *   The merge only removes the exclusion within that one directory - a negation
+ *   in a nested file still loses to an ancestor's exclusion.
+ *
+ * When `merge` is true, `filenames` order matters: they go into one matcher in
+ * order and the last matching pattern decides, so list them lowest-authority
+ * first.
+ */
+function createIgnoreChainResolver(read, filenames, merge) {
+    const cache = new Map();
+    const resolve = (dir) => {
+        const cached = cache.get(dir);
+        if (cached) {
+            return cached;
+        }
+        const contents = filenames
+            .map((name) => read(dir ? `${dir}/${name}` : name))
+            .filter((c) => !!c);
+        const matchers = merge
+            ? contents.length > 0
+                ? [contents.reduce((m, c) => m.add(c), ignore())]
+                : []
+            : contents.map((c) => ignore().add(c));
+        const inherited = dir === '' ? [] : resolve(posixDirname(dir));
+        const chain = matchers.length > 0 ? [{ dir, matchers }, ...inherited] : inherited;
+        cache.set(dir, chain);
+        return chain;
+    };
+    return resolve;
+}
+/**
+ * True when the file is ignored, resolving the chain nearest file first.
+ *
+ * Each matcher is tested against the path relative to its own directory, which
+ * is what makes a nested pattern like `/build` mean that directory's `build`
+ * rather than the workspace's.
+ *
+ * Nearest directory with an *opinion* wins, not the first match: a nested
+ * `!keep.log` must override the root's `*.log`, which is git's rule for files.
+ * A nested negation of a *directory* does not reach its children - see the
+ * `merge` note on `createIgnoreChainResolver`.
+ *
+ * How the files of one directory relate is decided when the chain is built - see
+ * that same note. Here they are simply the entry's matchers: any one excluding
+ * wins, and a negation counts only if none excluded.
+ *
+ * Two preconditions, both satisfied by a pruning walk and neither enforced:
+ *
+ * - `filePath` is workspace-relative POSIX and must sit under every `dir` in the
+ *   chain, which holds when the chain came from that file's own directory.
+ * - No ancestor directory of `filePath` may itself be ignored. git refuses to
+ *   re-include a file inside an excluded directory, and this does not implement
+ *   that rule: asked directly about `dist/keep.ts` with a root `dist/` and a
+ *   nested `dist/.gitignore` holding `!keep.ts`, it answers "not ignored" where
+ *   git says ignored (measured). `visitNotIgnoredFiles` never asks, because it
+ *   prunes `dist/` before descending - which is what makes its answers match
+ *   git, and why that pruning is load-bearing for correctness rather than speed.
+ */
+function isIgnoredByChain(chain, filePath) {
+    for (const { dir, matchers } of chain) {
+        const relative = dir === '' ? filePath : filePath.slice(dir.length + 1);
+        let unignored = false;
+        for (const matcher of matchers) {
+            const result = matcher.test(relative);
+            if (result.ignored) {
+                return true;
+            }
+            unignored ||= result.unignored;
+        }
+        if (unignored) {
+            return false;
+        }
     }
-    return ig;
+    return false;
+}
+let alwaysIgnored;
+/**
+ * Directories that should never be walked, whatever the workspace's own ignore
+ * files say - `node_modules`, `.git`, the nx caches.
+ *
+ * The list comes from the native walker rather than a second copy here, so a
+ * filesystem walk and a tree walk cannot drift apart.
+ *
+ * Checked ahead of the cascading chain rather than folded into it: these are not
+ * re-includable, and as ordinary patterns a nested negation could resurrect
+ * `node_modules`.
+ */
+function isAlwaysIgnored(path) {
+    alwaysIgnored ??= ignore().add((0, index_1.getHardcodedIgnorePatterns)());
+    return alwaysIgnored.ignores(path);
+}
+/**
+ * What git ignores, which is also what the native walker ignores.
+ *
+ * `.nxignore` outranks `.gitignore` - `walker.rs` registers it with
+ * `add_custom_ignore_filename` - which a merge with `.nxignore` last reproduces.
+ * git itself does not read it.
+ *
+ * Reads from the tree rather than disk because a generator can create or amend
+ * an ignore file in the same run, which would leave the on-disk copy stale.
+ */
+function createGitIgnoreChecker(tree) {
+    return createTreeIgnoreChecker(tree, {
+        filenames: ['.gitignore', '.nxignore'],
+        cascade: true,
+        merge: true,
+    });
+}
+/**
+ * What prettier ignores: the workspace root only, and one ignorer per
+ * `--ignore-path` ORed rather than merged (both measured), so a `!` in
+ * `.prettierignore` cannot re-include what `.gitignore` excluded. That is the
+ * CLI `nx format:check` shells out to.
+ *
+ * Not an exact match for that command: `isAlwaysIgnored` is wider than
+ * prettier's built-ins, and `format.ts` filters its own patterns through
+ * `.nxignore`, which this does not read.
+ *
+ * Reads from the tree rather than disk, as above.
+ */
+function createPrettierIgnoreChecker(tree) {
+    return createTreeIgnoreChecker(tree, {
+        filenames: ['.gitignore', '.prettierignore'],
+        cascade: false,
+        merge: false,
+    });
+}
+function createTreeIgnoreChecker(tree, { filenames, cascade, merge }) {
+    const resolve = createIgnoreChainResolver((path) => tree.read(path, 'utf-8'), filenames, merge);
+    // `probe` may carry a trailing slash; `path` never does. The chain is keyed by
+    // real directories, and `posixDirname('dist/')` is `'dist'` rather than the
+    // parent, so the lookup always uses the slash-less form.
+    const check = (path, probe) => isAlwaysIgnored(probe) ||
+        isIgnoredByChain(resolve(cascade ? posixDirname(path) : ''), probe);
+    return {
+        isIgnoredFile: (path) => check(path, path),
+        isIgnoredDirectory: (path) => check(path, `${path}/`),
+    };
+}
+/**
+ * `path.dirname` for the workspace-relative POSIX paths the chain is keyed by,
+ * except that the workspace root is `''` rather than `.` - that is the key
+ * `createIgnoreChainResolver` terminates on.
+ */
+function posixDirname(relativePath) {
+    const separator = relativePath.lastIndexOf('/');
+    return separator === -1 ? '' : relativePath.slice(0, separator);
 }
 /**
  * Adds an entry to a .gitignore file if it's not already covered by existing patterns.

package/dist/src/utils/nx-tmp-dir.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Stable root for Nx runtime artifacts that need an OS tmp location. On POSIX a
+ * literal `/tmp`, not `os.tmpdir()`, which honours `$TMPDIR` — per-user on
+ * macOS, rewritten by sandboxes, stripped from the daemon env, so client and
+ * daemon would disagree. Windows has no `/tmp`, and `%TMP%` is already per-user
+ * and stable, so it keeps `os.tmpdir()`.
+ *
+ * Consumed by the native binding loader, so keep this file limited to local
+ * helpers that themselves use Node builtins only.
+ */
+export declare const NX_TMP_DIR: string;
+/**
+ * Owner-only runtime root for the current user. No user segment on Windows —
+ * `%TMP%` is already per-account, and the segment would only cost path length.
+ */
+export declare const NX_USER_TMP_DIR: string;
+/** Runtime root under the user's home, used when the shared container cannot be established. */
+export declare const NX_HOME_TMP_DIR: string;